9.8

CVE-2023-38029

Saho ADM100&ADM-100FP - Arbitrary File Upload

Saho’s attendance devices ADM100 and ADM-100FP has insufficient filtering for special characters and file type within their file uploading function. A unauthenticate remote attacker authenticated can upload and execute arbitrary files to perform arbitrary system commands or disrupt service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Saho ≫ Adm-100 Firmware Version 0.0.4.0
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.3
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.6
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version 0.0.4.8
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version q20100602
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t190
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t17041702
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100 Firmware Version t18051803
   Saho ≫ Adm-100 Version -
Saho ≫ Adm-100fp Firmware Version q20100602
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t190
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t17041702
   Saho ≫ Adm-100fp Version -
Saho ≫ Adm-100fp Firmware Version t18051803
   Saho ≫ Adm-100fp Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.77% 0.508
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Cert TW 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://www.twcert.org.tw/tw/cp-132-7336-35a94-1.html
Third Party Advisory